MAL-2026-10205

    Dashboard / Malicious Package / MAL-2026-10205

    MAL-2026-10205

    Published: 12 Jul 2026Last Modified: 1 Sept 2026Aliases: 
    GHSA-rgpm-2hw4-8725

    Summary: Malicious code in library-explorer (npm)

    Details: Source: amazon-inspector (28b5db05b3bdfb9cc8b1af9759f05a3bc7a1b6a9c364b86831b93df78e9e2273) package.json declares `preinstall: node index.js`. On `npm install`, index.js collects installer host identity (os.hostname, os.platform, os.arch, os.homedir, os.userInfo username/uid/gid/shell, CPU/memory) and shells out `whoami` and (non-Windows) `id` via child_process.exec, then POSTs the aggregated JSON to a hardcoded Burp Collaborator subdomain at https://bgvge0daqrvkonl6x9qrx553ruxllb90.oastify.com/detox56. The package ships no real functionality (empty description/author, single preinstall script) and is consistent with a dependency-confusion / internal-name recon beacon staged to fire automatically on install.

    References: https://www.npmjs.com/package/library-explorer/v/25.2.1, https://github.com/advisories/GHSA-rgpm-2hw4-8725

    Affected packages

    Package

    Name: library-explorer

    Purl: pkg:npm/library-explorer

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    25.2.1
    MAL-2026-10205 | CVE-DB